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WHAT IS CLAIMED IS: 



1 LA computer-implemented method for detecting alarm conditions, the method 

2 comprising: 

3 receiving a first trigger event notification for a monitored occurrence on a network; 

4 asserting a first alarm condition to represent the first trigger event notification; 

5 receiving a next trigger notification after the first trigger event notification, the next 

6 trigger event notification also for the monitored occurrence; 

7 determining whether the next trigger event notification occurred within a 

8 predetermined amount of time after the first trigger event notification; 

9 if the next trigger event notification occurred within a predetermined time after the 

10 first trigger event notification, maintaining the first alarm condition; and 

11 if the next trigger event notification occurred more than said predetermined amount of 

12 time after the first trigger event notification, asserting a second alarm condition to represent 

1 3 the next trigger event notification. 

1 2. The method of claim 1 further comprising: 

2 establishing a redundancy window which specifies the predetermined amount of time; 

3 if said next trigger event notification occurs more than said predetermined amount of 

4 time after the first trigger event notification, detecting that the redundancy window has 

5 elapsed without an occurrence of a subsequent trigger event notification; and 

6 upon detecting that the redundancy window has elapsed without the occurrence of a 

7 subsequent trigger event notification, clearing the first alarm condition. 

1 3. The method of claim 2, wherein maintaining the first alarm condition fiirther 

2 comprises restarting the redundancy window based on when said next trigger event 

3 notification was received. 

1 4. The method of claim 1, wherein the first trigger event notification and said next 

2 trigger event notification are traps. 

1 5. A computer-implemented method for detecting alarm conditions, the method 

2 comprising: 
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3 periodically sampling the rate at which similar trigger event notifications arrive, 

4 wherein the trigger event notifications are for monitored occurrences on a network; 

5 comparing the sampled rate to a first threshold; 

6 periodically computing N, wherein N is the number of sampled rates within a 

7 preceding window of time that exceed said first threshold; 

8 each time N is computed, performing the operations of: 

9 (a) comparing N to a second threshold; 

10 (b) if N is greater than said second threshold and if a preexisting alarm 

1 1 condition does not exist, asserting a first alarm condition; and 

12 (c) if N is greater than said second threshold and if the preexisting alarm 

13 condition does exist, maintaining the preexisting alarm condition for a predetermined 

14 future period of time. 

1 6. The computer-implemented method of claim 5 wherein the operations further 

2 include (d) if N is not greater than the second threshold and if a preexisting alarm condition 

3 does exist and if the predetermined amount of time has elapsed since the immediately 

4 preceding last time that N exceeded the second threshold, clearing the preexisting alarm 

5 condition. 

1 7. The method of claim 5, wherein the trigger event notifications are traps. 

1 8. The method of claim 5, wherein the first threshold is zero. 

1 9. The method of claim 5, wherein the first threshold is greater than zero. 

1 10. The method of claim 5, wherein the second threshold varies as a function of time. 

1 11. The method of claim 10, further comprising computing the second threshold 

2 based on past performance of a parameter that is represented by the trigger event notification. 

1 12. A computer-implemented method for detecting alarm conditions, the method 

2 comprising: 

3 periodically sampling the rate Ri at which similar trigger event notifications arrive, 

4 wherein the trigger event notifications are for monitored occurrences on a network, and 
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5 wherein R\ is the sampled rate at time i; 

6 comparing the sampled rate Ri to a first threshold; 

7 for each sampled rate R\ that exceeds the first threshold, computing an amount Mi by 

8 which the sampled rate Ri exceeds said first threshold; 

9 periodically computing Ti which is a sum of Mi for all sample times i within a 

10 preceding window of time; 

1 1 for each Ti that is computed, performing the operations of: 

12 (a) comparing Ti to a second threshold; 

13 (b) if Ti is greater than said second threshold and if a preexisting alarm 

14 condition does not exist, asserting a first alarm condition; and 

15 (c) if Ti is greater than said second threshold and if the preexisting alarm 

16 condition does exist, maintaining the preexisting alarm condition for a predetermined 

1 7 future period of time. 

1 13. The computer-implemented method of claim 12 wherein the operations further 

2 include (d) if Tj is not greater than the second threshold and if a preexisting alarm condition 

3 does exist and if the predetermined amount of time has elapsed since the immediately 

4 preceding last time that Ti exceeded the second threshold, clearing the preexisting alarm 

5 condition. 

1 14. The method of claim 13, wherein the trigger event notifications are traps. 

1 15. The method of claim 13, wherein the first threshold is zero. 

1 16. The method of claim 13, wherein the first threshold is greater than zero. 

1 17. The method of claim 13, wherein the second threshold varies as a function of 

2 time. 

1 18. The method of claim 17, further comprising computing the second threshold 

2 based on past performance of a parameter that is represented by the trigger event notification. 

1 19. A machine-based method for displaying alarm data, the method comprising: 

2 receiving alarm data in a data table having colunms, data rows, and a subset of the 
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3 columns designated as key columns, the columns each corresponding to an alarm data field, 

4 the data rows each corresponding to a different alarm, and the subset being such that for any 

5 given data row in the data table and for a tuple constructed from values of the given data row 

6 corresponding to each of the columns of the subset, the tuple uniquely identifies the given 

7 data row relative to correspondingly constructed tuples for all other data rows in the data 

8 table; 

9 receiving a set of uncoUapsed columns that is a subset of the key colunms; 

10 grouping the data rows into display rows according to the set of uncoUapsed columns, 

1 1 such that a first data row is in a same display row as a second data row if the first data row 

12 and the second data row have matching values in each colunm in the set of uncoUapsed 

13 columns; and 

14 rendering the data table as a display table populated with the columns of the data 

15 table and with the display rows instead of the data rows. 

1 20. The method of claim 19, wherein rendering includes rendering placeholder 

2 symbols for cells in colunms that are not in the set of key columns. 

1 21. The method of claim 19, wherein rendering includes, if a column corresponds to 

2 a severity field of the alarm data, displaying in the cell of each row a value indicating the 

3 maximum severity among the alarm data corresponding to the row. 

1 22. The method of claim 19, further comprising receiving user input that designates 

2 the key colunms. 
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